CVE-2026-126235: Improper limitation of a pathname to a restricted directory in apache_mod
Published Nov 10, 2026
·Updated
A Path Traversal vulnerability [CWE-22] in FortiManager, FortiManager Cloud, FortiAnalyzer and FortiAnalyzer Cloud may allow an authenticated administrator to write arbitrary files via a specially crafted archive.
Affected Software
16 affected componentsFixes available
Fortinet FortiAnalyzer>=8.0.0<=8.0.1
Fortinet FortiAnalyzer>=7.6.2<=7.6.7
Fortinet FortiAnalyzer>=7.4.7<=7.4.11
Fortinet FortiAnalyzer>=7.2.10<=7.2.12
Fortinet FortiAnalyzer Cloud>=8.0.0<=8.0.1
Fortinet FortiAnalyzer Cloud>=7.6.0<=7.6.7
Fortinet FortiAnalyzer Cloud>=7.4.1<=7.4.11
Fortinet FortiAnalyzer Cloud>=7.2.1<=7.2.12
Fortinet FortiManager>=8.0.0<=8.0.1
Fortinet FortiManager>=7.6.2<=7.6.7
Fortinet FortiManager>=7.4.7<=7.4.11
Fortinet FortiManager>=7.2.10<=7.2.12
Fortinet FortiManager Cloud>=8.0.0<=8.0.1
Fortinet FortiManager Cloud>=7.6.0<=7.6.7
Fortinet FortiManager Cloud>=7.4.1<=7.4.11
Fortinet FortiManager Cloud>=7.2.1<=7.2.12
Event History
Nov 10, 2026
Advisory Published
via FortiGuard·12:00 AM
Data Sourced
via FortiGuard·12:00 AM
DescriptionSeverityWeaknessAffected Software